[
https://issues.apache.org/jira/browse/RANGER-5819?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Vyom Mani Tiwari resolved RANGER-5819.
--------------------------------------
Fix Version/s: 3.0.0
2.10
Resolution: Fixed
> Make grant/revoke endpoint security patterns slash-insensitive (follow-up to
> RANGER-5677)
> -----------------------------------------------------------------------------------------
>
> Key: RANGER-5819
> URL: https://issues.apache.org/jira/browse/RANGER-5819
> Project: Ranger
> Issue Type: Improvement
> Components: Ranger
> Affects Versions: 2.8.0, 2.9.0
> Reporter: Vyom Mani Tiwari
> Assignee: Vyom Mani Tiwari
> Priority: Major
> Fix For: 3.0.0, 2.10
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> RANGER-5677 made the non-secure {{download}} endpoint URL patterns in
> {{security-applicationContext.xml}} slash-insensitive ({{{}/{*}{*}{}}} \{*}→
> {{/}}{*}{{{}**{}}}{*}) so that trailing-slash variants resolve to the same
> Spring Security rule. That change covered only the {{download/}}{*} endpoints.
> The {{{}grant{}}}/{{{}revoke{}}} endpoints still use single-segment {{*}}
> patterns and were not included:
>
> {{/service/plugins/services/grant/*
> /service/plugins/services/revoke/*
> /service/assets/resources/grant
> /service/assets/resources/revoke}}
> Because Jersey resolves a trailing slash to the same resource method
> (sub-resource methods are compiled with an optional {{?}} suffix) while the
> Spring Ant matcher {{*}} does not match the trailing-slash form, a request to
> these endpoints with a trailing slash is matched by a different filter chain
> than the canonical path. This inconsistency should be removed so all variants
> of these endpoints resolve to the same, intended rule, matching the treatment
> already applied to the download endpoints.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
